CAPEC-275: DNS Rebinding
Description
An adversary serves content whose IP address is resolved by a DNS server that the adversary controls. After initial contact by a web browser (or similar client), the adversary changes the IP address to which its name resolves, to an address within the target organization that is not publicly accessible. This allows the web browser to examine this internal address on behalf of the adversary.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The target browser must access content server from the adversary controlled DNS name. Web advertisements are often used for this purpose. The target browser must honor the TTL value returned by the adversary and re-resolve the adversary's DNS name after initial contact.
Skills required
- MediumSetup DNS server and the adversary's web server. Write a malicious script to allow the victim to connect to the web server.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- AccountabilityAuthenticationAuthorizationNon-Repudiation
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
Mitigations
- Design: IP Pinning causes browsers to record the IP address to which a given name resolves and continue using this address regardless of the TTL set in the DNS response. Unfortunately, this is incompatible with the design of some legitimate sites.
- Implementation: Reject HTTP request with a malicious Host header.
- Implementation: Employ DNS resolvers that prevent external names from resolving to internal addresses.